Total
1353 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-63738 | 1 Rockoa | 1 Rockoa | 2026-10-15 | N/A | 4.3 MEDIUM |
| An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php. | |||||
| CVE-2026-110284 | 2026-10-15 | N/A | 7.5 HIGH | ||
| The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included. | |||||
| CVE-2026-104995 | 2026-10-14 | N/A | 8.1 HIGH | ||
| The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8. | |||||
| CVE-2026-104909 | 2026-10-14 | N/A | 8.1 HIGH | ||
| The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request. | |||||
| CVE-2026-103367 | 2026-10-14 | N/A | 8.1 HIGH | ||
| The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires a published recipe that processes the {{ customer.first_name }} placeholder — the plugin's built-in "New Order email with social media profile links" recipe satisfies this requirement out of the box, making the default configuration exploitable with no account, cookie, or nonce by simply submitting a guest checkout with the payload as the billing first name. | |||||
| CVE-2026-104899 | 2026-10-13 | N/A | 8.1 HIGH | ||
| The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is trivially obtainable by any anonymous visitor, as the geodir_basic_nonce value is localized to every public frontend page via the geodir_params script object, meaning no authentication, user interaction, or specific site content is required to exploit this vulnerability. | |||||
| CVE-2026-62066 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Volos <= 1.2 versions. | |||||
| CVE-2026-62068 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. | |||||
| CVE-2026-62092 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. | |||||
| CVE-2026-62094 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. | |||||
| CVE-2026-62067 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. | |||||
| CVE-2026-62020 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. | |||||
| CVE-2026-62115 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. | |||||
| CVE-2026-62069 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. | |||||
| CVE-2026-62032 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. | |||||
| CVE-2026-42724 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. | |||||
| CVE-2026-42777 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. | |||||
| CVE-2026-48194 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. | |||||
| CVE-2026-42704 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | |||||
| CVE-2026-48193 | 2026-10-13 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. | |||||